CISA has issued urgent warnings regarding two critical security vulnerabilities in N-able N-Central remote monitoring and management (RMM) software that threat actors are actively exploiting.

The vulnerabilities, identified as CVE-2025-8875 and CVE-2025-8876, pose significant risks to organizations using this widely-deployed IT management platform.

Key Takeaways
1. Two critical N-able N-Central vulnerabilities were actively exploited for remote code execution.
2. CISA deadline: August 20, 2025, for mandatory fixes.
3. Update or discontinue use immediately.

Deserialization Vulnerability

The first vulnerability, CVE-2025-8875, represents an insecure deserialization vulnerability that could lead to arbitrary command execution on affected systems.

Deserialization attacks occur when untrusted data is processed by an application’s deserialization mechanism, potentially allowing attackers to manipulate object states and execute malicious code.

This particular flaw in N-able N-Central’s architecture creates a pathway for remote attackers to gain unauthorized access and control over managed systems.

The technical nature of this vulnerability lies in the improper handling of serialized objects within the N-Central platform.

When the application deserializes user-controlled input without proper validation, it creates an attack vector that sophisticated threat actors can exploit to bypass security controls and establish persistent access to target networks.

The Common Vulnerability Scoring System (CVSS) implications of this flaw make it a high-priority concern for security teams.

Command Injection Vulnerability

The second vulnerability, CVE-2025-8876, involves a command injection vulnerability stemming from improper sanitization of user input within the N-Central application.

Command injection attacks allow malicious actors to execute arbitrary system commands by manipulating input fields that are processed by the underlying operating system without adequate filtering or validation.

This vulnerability specifically targets the input validation mechanisms within N-Central’s user interface, where insufficient input sanitization procedures fail to prevent the execution of injected shell commands.

Attackers can potentially leverage this weakness to execute system-level commands, access sensitive files, modify system configurations, or install malicious software on compromised systems.

Mitigations

CISA has established an aggressive remediation timeline, requiring organizations to implement mitigations by August 20, 2025, just one week after the vulnerabilities were added to the Known Exploited Vulnerabilities (KEV) catalog on August 13.

The urgency reflects the active exploitation of these vulnerabilities in real-world attack scenarios.

Organizations must immediately apply vendor-provided patches and mitigations, follow applicable Binding Operational Directive (BOD) 22-01 guidance for cloud services, or discontinue use of affected N-Central deployments if adequate mitigations remain unavailable.

N-able has released version 2025.3.1 of N-Central to address these security issues.

While the connection to ransomware campaigns remains unknown, the combination of deserialization and command injection vulnerabilities creates a potent attack surface that threat actors could exploit for initial access, lateral movement, and payload deployment across enterprise networks.

Boost your SOC and help your team protect your business with free top-notch threat intelligence: Request TI Lookup Premium Trial.

The post CISA Warns of N-able N-Central Deserialization and Injection Vulnerability Exploited in Attacks appeared first on Cyber Security News.